System and method for real time secure image based key generation using partial polygons assembled into a master composite image

ABSTRACT

A method including: receiving, at a first device, a challenge provided from a second device, wherein the challenge includes an encoding algorithm and a request for credentials from the first device; and outputting, from the first device to the second device, a response to the challenge, wherein the response includes at least one image, the at least one image including an article of evidence arranged according to the encoding algorithm.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims priority to U.S. patent application Ser. No.13/624,020 filed Sep. 21, 2012, the disclosure of which is incorporatedby reference herein in its entirety.

BACKGROUND

1. Technical Field

The present invention relates to electronic authentication.

2. Discussion of the Related Art

Authentication using mobile devices is a growing commodity. However,using a set of challenges like pre-defined passwords or pin numbersintroduces a risk of compromising the integrity of the authenticationprocess. From badge readers, to financial transactions based on nearfield communication, the risk of presenting a static/pre-defined set ofcredentials is part of the problem, not part of the solution. Forexample, if a badge has to present the same code to a reader, a mobiledevice has to present the same set of credentials (e.g., password, PINnumber, etc.) to complete a transaction, or a credit card has the sameinformation stored in a magnetic field, hackers may find ways to breakinto these static vaults and acquire credentials.

BRIEF SUMMARY

The present invention discloses a system and method for generating amaster key and subsequent images which contain a combination ofmeaningful and non-meaningful information. The master key image containsa list of meaningful polygons (or other descriptors) which allow thereader of the these transmitted images to assemble a virtual aggregatekey. The resultant key is therefore never transmitted but is ratherassembled dynamically from the sequence of images.

In an exemplary embodiment of the present invention, the methodincludes: receiving, at a first device, a challenge provided from asecond device, wherein the challenge includes an encoding algorithm anda request for credentials from the first device; and outputting, fromthe first device to the second device, a response to the challenge,wherein the response includes at least one image, the at least one imageincluding an article of evidence arranged according to the encodingalgorithm.

The encoding algorithm identifies where the article of evidence is to bepositioned in the at least one image.

The article of evidence is included within a polygon in the at least oneimage.

The at least one image includes a bar code.

The first device includes a mobile device.

The second device includes a server.

The method further comprises: authenticating the first device inresponse to the challenge response; and permitting the first device toaccess a desired resource in response to the authentication of the firstdevice, wherein the authenticating and permitting are performed usingthe second device.

The first device or the second device is a program or a virtual device.

The at least one image includes a quick response code.

In an exemplary embodiment of the present invention, the methodincludes: receiving, at a first device, a challenge from a seconddevice, wherein the challenge includes a request for credentials fromthe first device; and outputting, from the first device to the seconddevice, a response to the challenge, wherein the response includes anencoding algorithm and at least one image that includes an article ofevidence arranged according to the encoding algorithm.

The encoding algorithm is included in an image.

The method further comprises extracting, at the second device, thearticle of evidence from the at least one image according to theencoding algorithm.

In an exemplary embodiment of the present invention, the methodincludes: receiving, at a first device, a challenge request from asecond device, wherein the challenge request includes a request forcredentials from the first device and an identification of areas wherethe credentials are to be included in images; generating, with the firstdevice, a plurality of images, wherein at least one image includes atleast one article of evidence indicative of at least one of thecredentials, and the at least one article of evidence is arranged in theimage as indicated by the area corresponding thereto; providing, fromthe first device, the plurality of images as a composite image to thesecond device; providing the composite image to a third device from thesecond device; and validating, at the third device, the first deviceusing the composite image.

Prior to the challenge request being sent to the first device from thesecond device, the challenge request is generated in the third deviceand provided to the second device based on an initial communicationbetween the first and second devices.

The first device includes a mobile device, the second device includes avalidator and the third device includes a server.

In an exemplary embodiment of the present invention, the method includesreceiving, at a first device, a challenge request from a second device,wherein the challenge request includes a request for credentials fromthe first device; generating, with the first device, a plurality ofimages, wherein each image includes at least one article of evidenceindicative of at least one of the credentials, and the at least onearticle of evidence is arranged in the image according to an encodingalgorithm; providing, the plurality of images as a composite image to athird device; and providing the composite image to the second devicefrom the third device.

The first device includes a mobile device, the second device includes aserver and the third device includes a validator.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS

FIG. 1 illustrates a challenge request and a challenge responseaccording to an exemplary embodiment of the present invention;

FIG. 2 illustrates images included in a challenge response according toan exemplary embodiment of the present invention;

FIG. 3 illustrates a challenge request and a challenge responseaccording to an exemplary embodiment of the present invention;

FIG. 4 illustrates images included in a challenge response according toan exemplary embodiment of the present invention;

FIG. 5 illustrates an authentication flow between a mobile device,validator and server according to an exemplary embodiment of the presentinvention;

FIG. 6 illustrates an authentication flow between a mobile device,validator and server according to an exemplary embodiment of the presentinvention; and

FIG. 7 illustrates an apparatus for implementing an exemplary embodimentof the present invention.

DETAILED DESCRIPTION

The invention disclosed herein introduces two main concepts that work inconcert to provide the needed level of security to ensure a random andunique authentication process.

First, the invention elevates the security challenge to be dynamic andnot stored on a mobile device. For example, the server generates a newchallenge and provides it to the mobile device. An application/logiclayer in the mobile device will respond and stream the challengeresponse. Then, resource access is granted by the server, e.g., meaningauthentication completion. As a result, predicting the type of challengeand the outcome of that challenge is virtually impossible.

Second, the invention minimizes identity theft as an identity isrepresented as a series of articles that are dependant on one another.Getting a hold of any single article is useless. Getting a hold of allof them without knowing how to assemble them is useless as well.

In accordance with exemplary embodiments of the present invention, amobile device may be a smart phone, a tablet, a laptop, a smart card,for example, a validator may be a badge reader, a credit card reader, aproxy server, for example, and the server may be cloud based, forexample. The validator may also be a program in the cloud. Further, anon-portable compute device may be used in place of the mobile device.Further, the mobile device, validator and server may be a program or avirtual device.

In accordance with exemplary embodiments of the present invention, arequested resource may be access to a protected room, access to adigital file, access to email, or access to any other digital orphysical assets, for example.

A method in accordance with an exemplary embodiment of the presentinvention will now be discussed. More particularly, a method forauthentication between a mobile device and a server is disclosedhereafter with reference to FIGS. 1 and 2.

As shown in FIG. 1, a mobile device and a server are in communicationwith each other. The initiation of this communication may occur as theresult of the mobile device requesting a resource from the server via amiddleman. The initiation process will be discussed later. In responseto the resource request, the server provides a challenge request to themobile device (1). The challenge request contains credentials that theserver wants from the mobile device as well as an encoding algorithm.The encoding algorithm indicates how the credentials are to be encodedby the mobile device. The encoding algorithm may be described within adescriptor file included in a descriptor/manifest image, for example.

More specifically, the challenge request may ask the mobile device toprovide the following as credentials: device model, GPS chip type,processor chip type, etc. As it pertains to encoding, the challengerequest may ask the mobile device to provide each of these credentialsin a separate image and to group these images as a composite image.Further, with regard to encoding, the challenge request may ask themobile device to put the credentials in specific areas of the images.For example, the challenge request may require the device model to beput in polygon X in position X of image X, the GPS chip type to be putin polygon Y in position Y of image Y and the processor chip type to beput in polygon Z in position Z of image Z.

Although the above challenge request asks for credentials pertaining tohardware aspects of the mobile device, the credentials are not limitedthereto. For example, the requested credentials may include the name ofa user, the operating system of the device, the user's password, deviceattributes, compute node attributes (e.g., MAC address). More than onecredential may be put in a single image. The composite image may beanimated.

The mobile device may provide a response to the challenge request (2).The challenge response may include the encoded credentials. An exampleof the challenge response is shown in FIG. 2.

For example, image A may include the device model in polygon 1 in thelocation of image A specified by the server. Image B may include the GPSchip type in polygon 2 in the location of image B specified by theserver. Image C may include the processor chip type in polygon 3 in thelocation of image C specified by the server. Image D may include thedevice's build number in polygon 4 in the location of image D specifiedby the server. The combination of all these images is shown as thecomposite image in FIG. 2.

Although quick response (QR) codes are shown as the images in FIG. 2,other types of barcodes may be used as the images. Further, non-barcodeimages may be used as well. For example, an image of the mobile device'suser may be chosen by the server as the image in which to embed therequested credentials. In this case, the server may tell the mobiledevice to insert the device type into the right eye of the user, the GPSchip type into the left eye of the user and a password into the mouth ofthe user.

As can be seen, with the type of challenge request disclosed above, thechallenge response encoding permutations are almost infinite.

Upon receipt of the challenge response from the mobile device, theserver may authenticate credentials therein and provide the mobiledevice with the requested resource. Authentication is possible, sincethe server knows the encoding of the data in the composite image. On theother hand, the authentication may be performed by the middleman. Thisis will be discussed later.

A method in accordance with an exemplary embodiment of the presentinvention will now be discussed. More particularly, a method forauthentication between a mobile device and a server is disclosedhereafter with reference to FIGS. 3 and 4.

As shown in FIG. 3, the server provides a challenge request to themobile device (1). However, unlike that shown in FIG. 1, the challengerequest only includes the credentials that the server wants from themobile device. The mobile device may provide a response to the challengerequest (2). Unlike the challenge response shown in FIG. 2, thechallenge response may include an encoding algorithm and the encodedcredentials. The encoding algorithm may be selected by the mobiledevice. An example of the challenge response is shown in FIG. 4.

For example, descriptor/manifest image contains the encoding algorithmdetails. In other words, it identifies the credentials 1-4 and where thecredentials are to be found in each of images A-D. In more detail, theencoding algorithm is described within a descriptor file within thedescriptor/manifest image. An example descriptor file is shown below.

<descriptor file> <challenge> <article>device model </article><encoding>Image A, Polygon 1</encoding> </challenge> </ descriptor file>

The descriptor file can be obfuscated using any of a plurality ofmethods that the server is known to understand. For example, in additionto being included in the descriptor/manifest image, it may encrypted orpassword protected. Further, the descriptor file may not be a file atall; rather, the information included therein may be dependent on theprotocol used for communication.

As mentioned above, the user that is requiring access to some resourceis faced with a middleman between the user's device and the server. Thisinteraction will now be discussed with references to FIGS. 5 and 6.

As shown in FIG. 5, to initiate a request for a resource access, whichin turn initiates an authentication process, a mobile device can bebumped or be in close proximity to a validator (e.g., badge reader),when both devices employ near field communication for example. Anyapproach used to establish radio or non-radio communication between twoor more devices may be used in accordance with this invention. Thevalidator may now act as the middleman between the server and the mobiledevice. In this scenario, the mobile device knows nothing about theserver.

The validator obtains a challenge from the server and provides thatchallenge to the mobile device. The challenge may be generated by achallenge engine of the server. In accordance with an exemplaryembodiment of the present invention, the validator may ask the mobiledevice to stream a series of processed images using a specifiedalgorithm. The number of images to be streamed back and the algorithmapplied on each image may be variable each time the validator isengaged.

As shown in FIG. 5, the mobile device has the logic needed (e.g.,challenge response generator) to translate the challenge communicatedand prepare/present a challenge response. The mobile device also has thelogic needed (e.g., descriptor file) to encode its data if no encodingalgorithm is provided from the server. The challenge response generatorof the mobile device generates a plurality of individual images II₀ . .. II_(n) to create a final image II_(final). Here, the II refer tointelligent images such as QR codes. The final image, which may be thegenerated series of images or a composite (e.g., aggregated images, suchas animated images or video) is streamed back to the validator. Thevalidator can perform extraction of data from sent images then send thedata to the server, or it can send the raw challenge response to theserver for analysis by its validation engine.

In the exemplary embodiment shown and described with reference to FIG.5, the authentication validator is connected to a centralized server,which initiates the authentication challenge dynamically once a mobiledevice initiates a resource access request within a certain proximity tothe validator. This challenge can be unique and different each time thevalidator is approached/initiated. As a result, it is highly unlikely tocommit identity fraud.

FIG. 6 shows an embodiment of the invention in which the servercommunicates the challenge response directly to the mobile device. Thevalidator acts as the middleman only for the challenge response. In thealternative, the challenge response may be sent directly to the serverfrom the mobile device.

As will be appreciated by one skilled in the art, aspects of the presentinvention may be embodied as a system, method or computer programproduct. Accordingly, aspects of the present invention may take the formof an entirely hardware embodiment, an entirely software embodiment(including firmware, resident software, micro-code, etc.) or anembodiment combining software and hardware aspects that may allgenerally be referred to herein as a “circuit,” “module” or “system.”Furthermore, aspects of the present invention may take the form of acomputer program product embodied in one or more computer readablemedium(s) having computer readable program code embodied thereon.

Any combination of one or more computer readable medium(s) may beutilized. The computer readable medium may be a computer readable signalmedium or a computer readable storage medium. A computer readablestorage medium may be, for example, but not limited to, an electronic,magnetic, optical, electromagnetic, infrared, or semiconductor system,apparatus, or device, or any suitable combination of the foregoing. Morespecific examples (a non-exhaustive list) of the computer readablestorage medium would include the following: an electrical connectionhaving one or more wires, a portable computer diskette, a hard disk, arandom access memory (RAM), a read-only memory (ROM), an erasableprogrammable read-only memory (EPROM or Flash memory), an optical fiber,a portable compact disc read-only memory (CD-ROM), an optical storagedevice, a magnetic storage device, or any suitable combination of theforegoing. In the context of this document, a computer readable storagemedium may be any tangible medium that can contain, or store a programfor use by or in connection with an instruction execution system,apparatus, or device.

A computer readable signal medium may include a propagated data signalwith computer readable program code embodied therein, for example, inbaseband or as part of a carrier wave. Such a propagated signal may takeany of a variety of forms, including, but not limited to,electro-magnetic, optical, or any suitable combination thereof. Acomputer readable signal medium may be any computer readable medium thatis not a computer readable storage medium and that can communicate,propagate, or transport a program for use by or in connection with aninstruction execution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmittedusing any appropriate medium, including but not limited to wireless,wireline, optical fiber cable, RF, etc., or any suitable combination ofthe foregoing.

Computer program code for carrying out operations for aspects of thepresent invention may be written in any combination of one or moreprogramming languages, including an object oriented programming languagesuch as Java, Smalltalk, C++ or the like and conventional proceduralprogramming languages, such as the “C” programming language or similarprogramming languages. The program code may execute entirely on theuser's computer, partly on the user's computer, as a stand-alonesoftware package, partly on the user's computer and partly on a remotecomputer or entirely on the remote computer or server. In the latterscenario, the remote computer may be connected to the user's computerthrough any type of network, including a local area network (LAN) or awide area network (WAN), or the connection may be made to an externalcomputer (for example, through the Internet using an Internet ServiceProvider).

Aspects of the present invention are described with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems) and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer program instructions. These computer program instructions maybe provided to a processor of a general purpose computer, specialpurpose computer, or other programmable data processing apparatus toproduce a machine, such that the instructions, which execute via theprocesssor of the computer or other programmable data processingapparatus, create means for implementing the functions/acts specified inthe flowchart and/or block diagram block or blocks.

These computer program instructions may also be stored in a computerreadable medium that can direct a computer, other programmable dataprocessing apparatus, or other devices to function in a particularmanner, such that the instructions stored in the computer readablemedium produce an article or manufacture including instructions whichimplement the function/act specified in the flowchart and/or blockdiagram block or blocks.

The computer program instructions may also be loaded onto a computer,other programmable data processing apparatus, or other devices to causea series of operational steps to be performed on the computer, otherprogrammable apparatus or other devices to produce a computerimplemented process such that the instructions which execute on thecomputer or other programmable apparatus provide processes forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks.

Referring now to FIG. 7, according to an exemplary embodiment of thepresent invention, a computer system 701 can comprise, inter alia, a CPU702, a memory 703 and an input/output (I/O) interface 704. The computersystem 701 is generally coupled through the I/O interface 704 to adisplay 705 and various input devices 706 such as a mouse and keyboard.The support circuits can include circuits such as cache, power supplies,clock circuits, and a communications bus. The memory 703 can includeRAM, ROM, disk drive, tape drive, etc., or a combination thereof.Exemplary embodiments of present invention may be implemented as aroutine 707 stored in memory 703 (e.g., a non-transitorycomputer-readable storage medium) and executed by the CPU 702 to processthe signal from the signal source 708. As such, the computer system 701is a general-purpose computer system that becomes a specific purposecomputer system when executing the routine 707 of the present invention.

The computer platform 701 also includes an operating system andmicro-instruction code. The various processes and functions describedherein may either be part of the micro-instruction code or part of theapplication program (or a combination thereof) which is executed via theoperating system. In addition, various other peripheral devices may beconnected to the computer platform such as an additional data storagedevice and a printing device.

The flowchart and block diagrams in the figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof code, which comprises one or more executable instructions forimplementing the specified logical functions(s). It should also be notedthat, in some alternative implementations, the functions noted in theblock may occur out of the order noted in the figures. For example, twoblocks shown in succession may, in fact, be executed substantiallyconcurrently, or the blocks may sometimes be executed in the reverseorder, depending upon the functionality involved. It will also be notedthat each block of the block diagrams and/or flowchart illustration, andcombinations of blocks in the block diagrams and/or flowchartillustration, can be implemented by special purpose hardware-basedsystems that perform the specified functions or acts, or combinations ofspecial purpose hardware and computer instructions.

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting of the invention. Asused herein, the singular forms “a,” “an” and “the” are intended toinclude the plural forms as unless the context clearly indicatesotherwise. It will be further understood that the terms “comprises”and/or “comprising,” when used in this specification, specify thepresence of stated features, integers, steps, operations, elements,and/or components, but do not preclude the presence or addition of oneor more other features, integers, steps, operations, elements,components, and/or groups thereof.

The corresponding structures, materials, acts, and equivalents of allmeans or step plus function elements in the claims below are intended toinclude any structure, material, or act for performing the function incombination with other claimed elements as specifically claimed. Thedescription of the present invention has been presented for purposes ofillustration and description, but is not intended to be exhaustive orlimited to the invention in the form disclosed. Many modifications andvariations will be apparent to those of ordinary skill in the artwithout departing from the scope and spirit of the invention. Theembodiment was chosen and described in order to best explain theprinciples of the invention and the practical application, and to enableothers of ordinary skill in the art to understand the invention forvarious embodiments with various modifications as are suited to theparticular use contemplated.

1. A system, comprising: a first device and a second device, wherein thefirst device receives a challenge provided from a second device, whereinthe challenge includes an encoding algorithm and a request forcredentials from the first device, wherein a response to the challengeis output, from the first device to the second device, wherein theresponse includes an image, the image including articles of evidencearranged according to the encoding algorithm, wherein the second deviceassembles a key from the articles of evidence and wherein the keypermits the first device with access to a desired resource.
 2. Thesystem of claim 1, wherein the encoding algorithm identifies where thearticles of evidence are to be positioned in the image.
 3. The system ofclaim 1, wherein at least one of the articles of evidence is includedwithin a polygon in the image.
 4. The system of claim 1, wherein theimage includes a bar code.
 5. The system of claim 1, wherein the firstdevice includes a mobile device.
 6. The system of claim 1, wherein thesecond device includes a server.
 7. The system of claim 1, wherein thesecond device authenticates the first device in response to thechallenge response and permits the first device to access the desiredresource in response to the authentication of the first device.
 8. Thesystem of claim 1, wherein the first device or the second device is aprogram or a virtual device.
 9. The system of claim 1, wherein the imageincludes a quick response code.
 10. A system, comprising: a first deviceand a second device, wherein the first device receives a challenge froma second device, wherein the challenge includes a request forcredentials from the first device, wherein a response to the challengeis output from the first device to the second device, wherein theresponse includes an encoding algorithm and at least one image thatincludes articles of evidence arranged according to the encodingalgorithm, wherein the second device assembles a key from the articlesof evidence and wherein the key permits the first device with access todesired content.
 11. The system of claim 10, wherein the encodingalgorithm is included in an image.
 12. The system of claim 10, whereinthe second device extracts the articles of evidence from the at leastone image according to the encoding algorithm.
 13. A system, comprising:a first device, a second device and a third device, wherein the firstdevice receives a challenge request from a second device, wherein thechallenge request includes a request for credentials from the firstdevice and an identification of areas where the credentials are to beincluded in images, wherein the first device generates a plurality ofimages, wherein at least one image includes at least one article ofevidence indicative of at least one of the credentials, and the at leastone article of evidence is arranged in the image as indicated by thearea corresponding thereto, wherein the first device provides theplurality of images as a composite image to the second device, whereinthe second device provides the composite image to a third device,wherein the third device assembles a key from the at least one articleof evidence included in the composite image, and wherein the thirddevice validates the first device using the key.
 14. The system of claim13, wherein prior to the challenge request being sent to the firstdevice from the second device, the challenge request is generated in thethird device and provided to the second device based on an initialcommunication between the first and second devices.
 15. The system ofclaim 13, wherein the first device includes a mobile device, the seconddevice includes a validator and the third device includes a server. 16.A system, comprising: a first device, a second device, and a thirddevice, wherein the first device receives a challenge request from asecond device, wherein the challenge request includes a request forcredentials from the first device, wherein the first device generates aplurality of images, wherein each image includes at least one article ofevidence indicative of at least one of the credentials, and the at leastone article of evidence is arranged in the image according to anencoding algorithm, wherein the plurality of images are provide as acomposite image to a third device, wherein the composite image isprovided to the second device from the third device, and wherein, at thesecond device, a key is assembled from the articles of evidence in thecomposite image, and the key permits the first device with access todesired content.
 17. The system of claim 16, wherein the first deviceincludes a mobile device, the second device includes a server and thethird device includes a validator.